Attention-aggregated Attack for Boosting the Transferability of Facial Adversarial Examples

Jian-Wei Li; Wen-Ze Shao

REVIEW 4 major objections 3 minor 31 references

Attention-aggregated Attack for Boosting the Transferability of Facial Adversarial Examples

T0 review · 4 major / 3 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read An Attention-aggregated Attack (AAA) sums the shifting attention maps of a surrogate face model across iteratively perturbed images, claiming the sum imitates other models' attention and boosts black-box transferability.

desk verdict Genuinely new attack recipe with wide experiments, but test-set-tuned hyperparameters and missing first-stage parameters keep the reported gains from being fully trustworthy. read the letter →

arxiv 2505.03383 v1 pith:X6HPT7AY submitted 2025-05-06 cs.CV

Jian-Wei Li , Wen-Ze Shao This is my paper · ORCID

classification cs.CV

keywords adversarialtransferabilityfacerecognitionblack-boxattackfeature-levelattentionaggregationmomentumiterativefacialexamples

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that face recognition models are idiosyncratic: each model leans on its own mix of decisive and auxiliary facial features, so an adversarial perturbation tuned to one model overfits and fails to transfer. To counter this, the paper introduces AAA, a feature-level attack that first lets the surrogate model's attention drift by applying a few momentum-iterated steps, then sums the mid-layer gradient maps (visual importance) across those steps to form a static attack weight. The aggregated weight is meant to spread destruction over all potentially critical facial features, imitating an ensemble of unseen models' attentions. If AAA works as claimed, adversarial examples crafted against one face model succeed against other black-box face models at higher rates than MIM or LGC, especially when combined with input diversity.

What carries the argument

The central object is the aggregated attention map I = sum_{k=0}^{N-1} partial D_{f_theta}(x_adv^k, x_r) / partial h_adv^k, where h_adv^k is a chosen mid-layer feature map of the surrogate model and x_adv^k are intermediate images from a momentum attack. The element-wise product I \odot h_adv inside the loss is the mechanism that steers the final perturbation: instead of following the source model's own dynamic gradient, the attack follows a static weighted sum of attention maps collected at different perturbation stages. The paper justifies the aggregation by asserting that facial features are orthogonal to each other in the pixel space, so summing the drifting attention maps spreads importance over the whole face rather than cancelling. The authors read the drifting attention as imitating the fixed attentions of different face models, giving an ensemble-like effect.

What would settle it

Compute the pairwise cosine similarities between the N collected attention maps, or their upsampled versions, on a sample of LFW faces; if the average absolute similarity is large and positive, the maps overlap rather than being orthogonal, and the aggregation mechanism is not what the gains come from. A second check is to find faces where the source model's attention on MIM-perturbed images barely overlaps the target model's attention on the clean image; if AAA's transfer advantage disappears on that subset, the imitation claim fails.

Watch

Extended reading notes

Core claim

AAA claims to boost adversarial transferability against face recognition models by destroying the facial features that other models would rely on, without knowing those models. The attack does this by computing attention maps as the gradient of the cosine-similarity loss with respect to a mid-layer feature map, taking those gradients at several intermediate adversarial images produced by momentum iterations, and summing them into the fixed weight I = sum_{k=0}^{N-1} partial D / partial h_adv^k. The attack loss L(x_adv) = sum(I \odot h_adv) then drives the final perturbation. The authors' comparison of AAA with MIM and LGC across FaceNet, SphereFace, CosFace, ArcFace, MobileFace, MobileNetV2, ShuffleNet-V1, ResNet50, and IResNet50 variants reports higher black-box attack success rates with and without DI/SIM/SG boosters, while white-box success remains near 100%. The paper also reports ablations on which layer to attack and on the noise budget used for the attention-transferring stage.

Load-bearing premise

The method rests on the assertion that facial features are orthogonal to each other in the pixel space, so summing attention maps spreads importance instead of cancelling.

Editorial extensions

If this is right

If AAA is right, black-box attacks on face recognition need no queries to the target model; only a surrogate model and repeated attention collection are required.
Combining AAA with input diversity strengthens transferability, and adding scale-invariant and smooth-gradient boosters further raises attack success across different architectures and losses.
The ablation results imply that attacking a middle layer is important for the method, so the layer choice is part of the recipe rather than a free parameter.
Crafting AAA on an ensemble of face models improves transferability further, which the paper reads as evidence that its single-model aggregation mimics an ensemble effect.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The orthogonality assumption is strong; one could measure the pairwise cosine similarities of the collected attention maps on real face images and check whether the aggregation is truly spreading importance rather than averaging overlapping gradients.
The attention-transferring stage is essentially a MIM trajectory, so one could test whether the order or number of collected steps, N, controls which facial features get covered, independent of the claimed imitation.
The same recipe could apply to other fine-grained, embedding-based recognition tasks such as bird or vehicle re-identification, where model-specific decisive features are also likely to hurt transferability.
The claim that the surrogate model's attention on MIM-perturbed images imitates other models' attention is supported only by visual inspection; a quantitative comparison of source-model attention on perturbed images with target-model attention on clean images would directly test it.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The thing to know about arXiv:2505.03383: it proposes a new feature-level attack for face recognition, called AAA, that collects mid-layer gradient maps along an MIM trajectory and sums them into a fixed importance mask. That specific construction, Eq. (7) and (8), is not in FIA, NAA, or LGC, and it is a reasonable idea: as MIM iterates, the source model's attention drifts, and aggregating those maps is a cheap ensemble-like spread across facial features. The paper deserves credit for that.

The experiments are extensive and consistent. They cover many source/target FR models, three model groupings, dodging and impersonation, plus DI/SIM/SG combinations and ensemble attacks. AAA beats MIM and LGC by a few points in almost every black-box cell, and the gains grow when combined with input diversity. That pattern is hard to explain away as noise alone.

The soft spots are real but not all equal. The most serious is selection bias: Section 3.3 chooses the per-source mid-layer and gamma by measuring attack success against the same 3000 LFW pairs that later populate Tables 1-6. There is no validation split. Since MIM and LGC have no comparable per-source tunable layer, AAA effectively gets an extra degree of freedom fitted to the test set. The reported advantage could be partly an artifact of that tuning. Second, Algorithm 1 lists first-stage parameters N and beta, but Section 3.1 never gives their values, so the configuration cannot be reproduced. Third, the orthogonality premise in Section 2.2, that facial features are orthogonal in pixel space, is asserted, not shown; if it fails, the aggregation rationale weakens, though the method could still work empirically. Minor: no error bars, no released code, and the paper is submitted in an unfinished template with corrupted figure captions.

Overall, the central claim is plausible and probably defensible, but the evidence as presented is not clean enough to take the reported numbers at face value. The right fix is a held-out validation split for hyperparameters, full disclosure of N and beta, and code. This deserves a serious referee, not a desk reject, but it needs major revision.

Referee Report

4 major / 3 minor

Summary. The paper proposes Attention-aggregated Attack (AAA), a transfer-based black-box attack for face recognition. The authors observe that different FR models weight different facial features, and that running MIM on a source model makes its mid-layer gradient 'attention' maps drift smoothly across facial regions. AAA therefore first runs N iterations of MIM with step size beta to create intermediate adversarial images, accumulates the source model's cosine-similarity gradients with respect to a chosen mid-layer feature map into a static importance map I (Eq. 7), and then attacks by minimizing L = sum(I * h_adv) with momentum (Algorithm 1, Eq. 8). The paper reports dodging and impersonation success rates on 3000 LFW pairs, comparing AAA with MIM and LGC, with and without DI/SIM/SG boosters, for single-model and ensemble attacks, across 12 FR models, and includes ablations over the attacked layer and the noise budget gamma. The central claim is that AAA consistently outperforms MIM and LGC on black-box targets because it destroys features that are critical to other FR models.

Significance. If the quantitative claims are reproducible, the paper makes a useful contribution to the adversarial-attack literature for fine-grained recognition: it provides a simple feature-level attack tailored to FR, shows that aggregating attention maps along an adversarial trajectory can improve transferability, and demonstrates compatibility with standard boosters. The experimental coverage is a genuine strength: twelve models spanning different backbones and losses, both dodging and impersonation, multiple perturbation budgets, ensemble attacks, and ablations. I do not see a circularity problem in the headline comparison, because the target models are external and no target-model labels or gradients are used to build the importance map. However, the absence of validation discipline, the unreported first-stage hyperparameters, and the unsupported orthogonality premise are load-bearing issues that must be fixed before the empirical advantage can be accepted as a property of AAA rather than of test-set tuning.

major comments (4)

[Section 3.1, Algorithm 1] The first-stage iteration count N and step size beta appear in Algorithm 1 as inputs but are never specified in Section 3.1 or in any experimental table. Only epsilon, T, alpha, momentum, gamma, and the attacked layer are given. Consequently, the exact configuration used to produce Tables 1-6 cannot be reproduced, and the comparison may not be at equal computational cost: AAA performs N additional forward/backward passes before the T iterations shared with MIM. Please report N and beta for every experiment and provide a runtime or FLOPs comparison with the baselines.
[Section 3.3, Figs. 2-3, Tables 1-4] The mid-layer attacked for each source model and the noise budget gamma are selected by success-rate measurements on LFW, the same dataset used for all reported results, and no validation split is described. Because MIM and LGC have no per-source-model layer knob, AAA is effectively granted an extra degree of freedom that is fitted to the evaluation benchmark, which can inflate its apparent advantage over the baselines. Please fix the layer choice and gamma on a held-out validation split (or a fixed rule, e.g., the same relative depth for all architectures) and report the final success rates on a disjoint test set, at minimum for Tables 1 and 4.
[Section 2.2, Eq. (7)] The claim that 'facial features are orthogonal to each other in the pixel space' is asserted without evidence or citation, and it is load-bearing: it is used to argue that summing the N attention maps spreads importance across features without destructive cancellation. If the maps are not orthogonal, the aggregate I may over-emphasize source-specific features or wash out, and the stated mechanism would fail even if the empirical results survive. Please supply quantitative evidence, such as pairwise cosine similarities of the N maps, or an ablation comparing the sum with a max-pooled or randomly selected map.
[Section 2.2, Fig. 1] The premise that the attention maps computed on MIM-perturbed images of one source model 'imitate' the attentions of other FR models on clean images is supported only by visual inspection of three models. This is a central interpretive claim of the paper. Please quantify the similarity (e.g., mean cosine similarity between the aggregated map and target-model attention maps on clean images) or demonstrate that AAA's gain remains when the aggregate is replaced by a non-attention alternative such as a fixed combination of the same N maps.

minor comments (3)

[Tables 1-6] All ASRs are reported as single percentages without error bars or significance tests; on 3000 test pairs the binomial standard error is on the order of one percentage point, and several reported advantages over the closest baseline are within that range. Please add multiple-run statistics or confidence intervals.
[Section 3.1, Fig. 1] Layer names should be formatted consistently; entries such as 'repeat.2 5', 'conv3 3', and 'stage3.ShuffleUnit Stage3 3' are hard to parse and should be normalized to the notation used in the model implementations.
[Eq. (9)] The notation in the chain-rule expression should be cleaned up: the gradient of D with respect to the feature map should be written with an explicit partial derivative in the denominator, and the text should clarify that the gradient is evaluated at x_adv^k rather than at the feature map itself.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: AAA's transferability is validated against external target models, and the attention aggregation is computed from the source model alone. Remaining issues are benchmark-tuning and reproducibility concerns, not derivation circularity.

full rationale

The paper's central claim is that adversarial examples crafted with AAA on a source FR model transfer better to other FR models. The attack loss in Eq. (8) is assembled from (i) the source model's mid-layer gradients on MIM-perturbed copies of the clean image (Eq. 7) and (ii) the source model's mid-layer features of the current adversarial example. No target-model parameters, labels, or attention maps are used in constructing I, and the reported success rates in Tables 1-6 are measured on target models other than the source model. The 'imitation of target attentions' is an explanatory analogy supported by Fig. 1, not a mathematical identification, so it is not a self-definitional reduction. The orthogonality premise in Section 2.2 is an unsupported assumption rather than a circular step, and the same-set selection of the mid-layer and gamma in Section 3.3 plus the unspecified N and beta in Algorithm 1 are reproducibility and selection-bias concerns, not derivation circularity. No load-bearing self-citation or imported uniqueness theorem appears. Accordingly the derivation is self-contained; no circular step is exhibited.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The method does not invent new physical entities. It depends on three domain assumptions about gradient-based attention and facial feature geometry, plus one literature-derived assumption about mid-layer similarity. The most fragile is the orthogonality premise, which is asserted without evidence.

free parameters (4)

First-stage iteration count N = not reported
Controls how many attention maps are aggregated; no value is given in the experimental settings, so the result cannot be reproduced.
First-stage step size beta = not reported
Step size for generating the adversarial images whose gradients form the attention maps; unspecified.
Budget of adversarial noise gamma = 8/255
Chosen based on ablation (Fig. 3) on the same LFW test pairs, so it is effectively fitted to the evaluation set.
Attacked mid-layer per model = e.g., layer2.3 (ResNet50), body.19 (ArcFace/IR models)
The layer choice is selected per model, and the ablation (Fig. 2) indicates it is picked to maximize transferability, i.e., tuned on the benchmark targets.

assumptions (4)

domain assumption Facial features are orthogonal to each other in the pixel space.
Invoked in Section 2.2 before Eq. (7) to justify that summed attention maps cover all features without interference; no evidence given.
domain assumption Gradients of the cosine similarity loss with respect to mid-layer feature maps measure the facial features an FR model relies on.
The method treats these gradients as 'attention' (Section 2.2); this interpretability assumption is stated but not validated.
domain assumption MIM-iterated adversarial images transfer a source model's attention in a way that resembles other models' attention on the clean image.
Supported only by the visualizations in Fig. 1; no quantitative measurement of the transfer is provided.
domain assumption Mid-layer features across different models are more transferable than shallow or deep features.
Borrowed from [19] and used to justify attacking a specific mid-layer; accepted as background.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Attention-aggregated Attack for Boosting the Transferability of Facial Adversarial Examples." pith.science (2026). https://pith.science/paper/X6HPT7AY

@misc{pith2026250503383,
  author       = {Pith},
  title        = {Pith review of: Attention-aggregated Attack for Boosting the Transferability of Facial Adversarial Examples},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/X6HPT7AY}},
  note         = {Machine review of arXiv:2505.03383}
}

read the original abstract

Adversarial examples have revealed the vulnerability of deep learning models and raised serious concerns about information security. The transfer-based attack is a hot topic in black-box attacks that are practical to real-world scenarios where the training datasets, parameters, and structure of the target model are unknown to the attacker. However, few methods consider the particularity of class-specific deep models for fine-grained vision tasks, such as face recognition (FR), giving rise to unsatisfactory attacking performance. In this work, we first investigate what in a face exactly contributes to the embedding learning of FR models and find that both decisive and auxiliary facial features are specific to each FR model, which is quite different from the biological mechanism of human visual system. Accordingly we then propose a novel attack method named Attention-aggregated Attack (AAA) to enhance the transferability of adversarial examples against FR, which is inspired by the attention divergence and aims to destroy the facial features that are critical for the decision-making of other FR models by imitating their attentions on the clean face images. Extensive experiments conducted on various FR models validate the superiority and robust effectiveness of the proposed method over existing methods.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

31 extracted references · 23 canonical work pages

[1]

Black-box adversarial attacks with limited queries and information,

A. Ilyas, L. Engstrom, A. Athalye, and J. Lin, “Black-box adversarial attacks with limited queries and information,” in International conference on machine learning. PMLR, 2018, pp. 2137–2146

work page 2018
[2]

Query- efficient black-box adversarial attacks guided by a transfer- based prior,

Y . Dong, S. Cheng, T. Pang, H. Su, and J. Zhu, “Query- efficient black-box adversarial attacks guided by a transfer- based prior,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 44, no. 12, pp. 9536–9548, 2021

work page 2021
[3]

Query- efficient black-box adversarial attack with customized iteration and sampling,

Y . Shi, Y . Han, Q. Hu, Y . Yang, and Q. Tian, “Query- efficient black-box adversarial attack with customized iteration and sampling,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 2, pp. 2226– 2245, 2022

work page 2022
[4]

Boosting query efficiency of meta attack with dynamic fine-tuning,

D. Lin, Y .-G. Wang, W. Tang, and X. Kang, “Boosting query efficiency of meta attack with dynamic fine-tuning,” IEEE Signal Processing Letters , vol. 29, pp. 2557–2561, 2022

work page 2022
[5]

Substitute meta-learning for black-box adversarial attack,

C. Hu, H.-Q. Xu, and X.-J. Wu, “Substitute meta-learning for black-box adversarial attack,” IEEE Signal Processing Letters, vol. 29, pp. 2472–2476, 2022

work page 2022
[6]

Improving transferability of adversarial examples with input diversity,

C. Xie, Z. Zhang, Y . Zhou, S. Bai, J. Wang, Z. Ren, and A. L. Yuille, “Improving transferability of adversarial examples with input diversity,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 2730–2739

work page 2019
[7]

Nesterov accelerated gradient and scale invariance for adversarial attacks,

J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft, “Nesterov accelerated gradient and scale invariance for adversarial attacks,” arXiv preprint arXiv:1908.06281 , 2019

arXiv 1908
[8]

Feature importance-aware transferable adversarial attacks,

Z. Wang, H. Guo, Z. Zhang, W. Liu, Z. Qin, and K. Ren, “Feature importance-aware transferable adversarial attacks,” in Proceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 7639–7648

work page 2021

Show all 31 references

[9]

Improving adversarial transferability via neuron attribution-based attacks,

J. Zhang, W. Wu, J.-t. Huang, Y . Huang, W. Wang, Y . Su, and M. R. Lyu, “Improving adversarial transferability via neuron attribution-based attacks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 14 993–15 002

2022
[10]

Robfr: Benchmarking adversarial robustness on face recognition,

X. Yang, D. Yang, Y . Dong, H. Su, W. Yu, and J. Zhu, “Robfr: Benchmarking adversarial robustness on face recognition,” arXiv preprint arXiv:2007.04118, 2020

2007 arXiv
[11]

Cue saliency in faces as assessed by the ‘photofit’technique,

G. Davies, H. Ellis, and J. Shepherd, “Cue saliency in faces as assessed by the ‘photofit’technique,” Perception, vol. 6, no. 3, pp. 263–269, 1977

1977
[12]

Evading defenses to transferable adversarial examples by translation-invariant attacks,

Y . Dong, T. Pang, H. Su, and J. Zhu, “Evading defenses to transferable adversarial examples by translation-invariant attacks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2019, pp. 4312– 4321

2019
[13]

Boosting adversarial attacks with momentum,

Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2018, pp. 9185–9193

2018
[14]

Explaining and harnessing adversarial examples,

I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572, 2014. 12 Tsinghua Science and Technology, F ebruary2018, 23(1): 000–000

2014 arXiv
[15]

Adversarial examples in the physical world,

A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” in Artificial intelligence safety and security . Chapman and Hall/CRC, 2018, pp. 99–112

2018
[16]

Boosting adversarial transferability by achieving flat local maxima,

Z. Ge, H. Liu, W. Xiaosen, F. Shang, and Y . Liu, “Boosting adversarial transferability by achieving flat local maxima,” Advances in Neural Information Processing Systems, vol. 36, pp. 70 141–70 161, 2023

2023
[17]

Improving the transferability of adversarial examples with arbitrary style transfer,

Z. Ge, F. Shang, H. Liu, Y . Liu, L. Wan, W. Feng, and X. Wang, “Improving the transferability of adversarial examples with arbitrary style transfer,” in Proceedings of the 31st ACM International Conference on Multimedia , 2023, pp. 4440–4449

2023
[18]

Adversarial attack on object detection via object feature- wise attention and perturbation extraction,

W. Xue, X. Xia, P. Wan, P. Zhong, and X. Zheng, “Adversarial attack on object detection via object feature- wise attention and perturbation extraction,” Tsinghua Science and Technology, 2024

2024
[19]

Learning transferable adversarial perturbations,

M. Salzmann et al. , “Learning transferable adversarial perturbations,” Advances in Neural Information Processing Systems, vol. 34, pp. 13 950–13 962, 2021

2021
[20]

Human face perception and identification,

V . Bruce, P. J. Hancock, and A. M. Burton, “Human face perception and identification,” Face Recognition: From theory to applications, pp. 51–72, 1998

1998
[21]

Identity mappings in deep residual networks,

K. He, X. Zhang, S. Ren, and J. Sun, “Identity mappings in deep residual networks,” in Computer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceedings, Part IV 14. Springer, 2016, pp. 630–645

2016
[22]

Mobilenetv2: Inverted residuals and linear bottlenecks,

M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen, “Mobilenetv2: Inverted residuals and linear bottlenecks,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 4510– 4520

2018
[23]

Labeled faces in the wild: A database forstudying face recognition in unconstrained environments,

G. B. Huang, M. Mattar, T. Berg, and E. Learned-Miller, “Labeled faces in the wild: A database forstudying face recognition in unconstrained environments,” in Workshop on faces in’Real-Life’Images: detection, alignment, and recognition, 2008

2008
[24]

Facenet: A unified embedding for face recognition and clustering,

F. Schroff, D. Kalenichenko, and J. Philbin, “Facenet: A unified embedding for face recognition and clustering,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2015, pp. 815–823

2015
[25]

Sphereface: Deep hypersphere embedding for face recognition,

W. Liu, Y . Wen, Z. Yu, M. Li, B. Raj, and L. Song, “Sphereface: Deep hypersphere embedding for face recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2017, pp. 212– 220

2017
[26]

Cosface: Large margin cosine loss for deep face recognition,

H. Wang, Y . Wang, Z. Zhou, X. Ji, D. Gong, J. Zhou, Z. Li, and W. Liu, “Cosface: Large margin cosine loss for deep face recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 5265–5274

2018
[27]

Arcface: Additive angular margin loss for deep face recognition,

J. Deng, J. Guo, N. Xue, and S. Zafeiriou, “Arcface: Additive angular margin loss for deep face recognition,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 4690–4699

2019
[28]

Mobilefacenets: Efficient cnns for accurate real-time face verification on mobile devices,

S. Chen, Y . Liu, X. Gao, and Z. Han, “Mobilefacenets: Efficient cnns for accurate real-time face verification on mobile devices,” in Biometric Recognition: 13th Chinese Conference, CCBR 2018, Urumqi, China, August 11-12, 2018, Proceedings 13. Springer, 2018, pp. 428–438

2018
[29]

Shufflenet: An extremely efficient convolutional neural network for mobile devices,

X. Zhang, X. Zhou, M. Lin, and J. Sun, “Shufflenet: An extremely efficient convolutional neural network for mobile devices,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2018, pp. 6848– 6856

2018
[30]

Smoothgrad: removing noise by adding noise,

D. Smilkov, N. Thorat, B. Kim, F. Vi ´egas, and M. Wattenberg, “Smoothgrad: removing noise by adding noise,” arXiv preprint arXiv:1706.03825, 2017

2017 arXiv
[31]

Deep residual learning for image recognition,

K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” inProceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

2016

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

Black-box adversarial attacks with limited queries and information,

A. Ilyas, L. Engstrom, A. Athalye, and J. Lin, “Black-box adversarial attacks with limited queries and information,” in International conference on machine learning. PMLR, 2018, pp. 2137–2146

work page 2018

[2] [2]

Query- efficient black-box adversarial attacks guided by a transfer- based prior,

Y . Dong, S. Cheng, T. Pang, H. Su, and J. Zhu, “Query- efficient black-box adversarial attacks guided by a transfer- based prior,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 44, no. 12, pp. 9536–9548, 2021

work page 2021

[3] [3]

Query- efficient black-box adversarial attack with customized iteration and sampling,

Y . Shi, Y . Han, Q. Hu, Y . Yang, and Q. Tian, “Query- efficient black-box adversarial attack with customized iteration and sampling,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 45, no. 2, pp. 2226– 2245, 2022

work page 2022

[4] [4]

Boosting query efficiency of meta attack with dynamic fine-tuning,

D. Lin, Y .-G. Wang, W. Tang, and X. Kang, “Boosting query efficiency of meta attack with dynamic fine-tuning,” IEEE Signal Processing Letters , vol. 29, pp. 2557–2561, 2022

work page 2022

[5] [5]

Substitute meta-learning for black-box adversarial attack,

C. Hu, H.-Q. Xu, and X.-J. Wu, “Substitute meta-learning for black-box adversarial attack,” IEEE Signal Processing Letters, vol. 29, pp. 2472–2476, 2022

work page 2022

[6] [6]

Improving transferability of adversarial examples with input diversity,

C. Xie, Z. Zhang, Y . Zhou, S. Bai, J. Wang, Z. Ren, and A. L. Yuille, “Improving transferability of adversarial examples with input diversity,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 2730–2739

work page 2019

[7] [7]

Nesterov accelerated gradient and scale invariance for adversarial attacks,

J. Lin, C. Song, K. He, L. Wang, and J. E. Hopcroft, “Nesterov accelerated gradient and scale invariance for adversarial attacks,” arXiv preprint arXiv:1908.06281 , 2019

arXiv 1908

[8] [8]

Feature importance-aware transferable adversarial attacks,

Z. Wang, H. Guo, Z. Zhang, W. Liu, Z. Qin, and K. Ren, “Feature importance-aware transferable adversarial attacks,” in Proceedings of the IEEE/CVF international conference on computer vision, 2021, pp. 7639–7648

work page 2021